@quantakrypto/core 0.4.3 → 0.5.0

package/src/detectors/jwk.ts

@@ -0,0 +1,170 @@
+/**
+ * Config detector: classical key material in JSON Web Keys (JWK / JWKS, RFC 7517
+ * / 7518). JWKs appear in `.json` / `.jwks` files, OIDC discovery documents, and
+ * config — a real key-material surface the source packs (which look at *code*)
+ * and the PEM detector (which looks at PEM markers) both miss.
+ *
+ * Detection keys off the JWK's distinctive JSON fields:
+ *  - `"kty":"RSA"`                          → classical RSA key.
+ *  - `"crv":"P-256"|"P-384"|"P-521"|…`      → classical EC key (ECDSA + ECDH).
+ *  - `"crv":"Ed25519"|"Ed448"`              → EdDSA signing key.
+ *  - `"crv":"X25519"|"X448"`                → classical Montgomery-curve key agreement.
+ *
+ * Usage-aware classification: when a key's surrounding `"use"` / `"alg"` marks it
+ * as a SIGNING key (`use:"sig"`, or an `RS`/`PS`/`ES` signature alg), the finding
+ * is a `signature` (`hndl:false`) — a signing key is forgeable at a CRQC but not
+ * harvest-now exposed. An encryption/unspecified key stays `hndl:true`.
+ *
+ * Deferrals to avoid double-counting: skipped on doc extensions (a README JWK
+ * example is not live) and inside CloudFormation/ARM templates, where the
+ * cloudformation detector owns the `kty` of a `Microsoft.KeyVault` key resource.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  enclosingObject,
+  findingFromRule,
+  hasExtension,
+} from "../detect-utils.js";
+import { isCloudTemplateFile } from "./cloudformation.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+interface JwkRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const JWK_RULES: JwkRule[] = [
+  {
+    re: /"kty"\s*:\s*"RSA"/g,
+    meta: {
+      id: "jwk-rsa",
+      title: "RSA JSON Web Key (JWK)",
+      description: 'JWK with "kty":"RSA" (RFC 7518)',
+      category: "certificate",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: "RSA JSON Web Key (JWK); classical RSA, not quantum-safe.",
+      remediation: "Re-issue with PQC keys (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+    },
+  },
+  {
+    re: /"crv"\s*:\s*"(?:P-256K?|P-384|P-521|secp256k1)"/g,
+    meta: {
+      id: "jwk-ec",
+      title: "EC JSON Web Key (JWK)",
+      description: 'JWK with an "crv" naming a NIST/secp curve (RFC 7518)',
+      category: "key-exchange",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "ECDH",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Elliptic-curve JSON Web Key (JWK); a classical EC key feeds BOTH ECDSA signatures and ECDH key agreement — the ECDH path is harvest-now-decrypt-later exposed.",
+      remediation:
+        "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+    },
+  },
+  {
+    re: /"crv"\s*:\s*"Ed(?:25519|448)"/g,
+    meta: {
+      id: "jwk-eddsa",
+      title: "EdDSA JSON Web Key (JWK)",
+      description: 'JWK OKP key with "crv":"Ed25519"/"Ed448" (RFC 8037)',
+      category: "signature",
+      severity: "low",
+      confidence: "high",
+      algorithm: "EdDSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "EdDSA (Ed25519/Ed448) JSON Web Key (JWK); classical and forgeable by a quantum attacker.",
+      remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+    },
+  },
+  {
+    re: /"crv"\s*:\s*"X(?:25519|448)"/g,
+    meta: {
+      id: "jwk-xdh",
+      title: "X25519/X448 JSON Web Key (JWK)",
+      description: 'JWK OKP key with "crv":"X25519"/"X448" (RFC 8037)',
+      category: "key-exchange",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "X25519",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "X25519/X448 JSON Web Key (JWK); modern but classical key agreement, and harvest-now-decrypt-later exposed.",
+      remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+    },
+  },
+];
+
+/**
+ * True when THIS key's own object marks it as a signing key via `use`/`alg`. The
+ * caller passes the enclosing `{…}` object so a neighbouring key in a JWKS array
+ * can't contaminate the result, and an explicit `"use":"enc"` on the key always
+ * wins (never classify an encryption key as a signature).
+ */
+function isSigningUse(objectText: string, sigAlg: RegExp): boolean {
+  if (/"use"\s*:\s*"enc"/.test(objectText)) return false;
+  return /"use"\s*:\s*"sig"/.test(objectText) || sigAlg.test(objectText);
+}
+
+const RSA_SIG_ALG = /"alg"\s*:\s*"(?:RS|PS)(?:256|384|512)"/;
+const EC_SIG_ALG = /"alg"\s*:\s*"ES(?:256K?|384|512)"/;
+
+/** Detects classical JSON Web Key (JWK/JWKS) material in any JSON/text file. */
+export const jwkDetector: Detector = {
+  id: "jwk-material",
+  description: "Classical key material in JSON Web Keys (JWK / JWKS)",
+  scope: "config",
+  language: "any",
+  rules: JWK_RULES.map((r) => r.meta),
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Fast reject: a JWK always has one of these two members.
+    if (!content.includes('"kty"') && !content.includes('"crv"')) return [];
+    // The ONLY overlap with the cloudformation detector is the ARM Key Vault key
+    // `kty:"RSA"` (cfn-arm-keyvault-rsa), which only fires when Microsoft.KeyVault is
+    // present. Defer just the RSA rule in that case — everything else (crv keys, and
+    // JWKs embedded in AWS CloudFormation, which cfn does not own) is still reported.
+    const isArm = isCloudTemplateFile(file, content) && content.includes("Microsoft.KeyVault");
+
+    const findings: Finding[] = [];
+    for (const rule of JWK_RULES) {
+      eachMatch(rule.re, content, (m) => {
+        if (rule.meta.id === "jwk-rsa" && isArm) return; // cfn-arm-keyvault-rsa owns it
+        const at = { file, content, index: m.index, matchLength: m[0].length };
+        // Analyse the key's OWN enclosing object so a neighbouring key in a JWKS
+        // array can't flip this key's sig/enc classification.
+        const obj = enclosingObject(content, m.index);
+        let overrides;
+        if (rule.meta.id === "jwk-rsa" && isSigningUse(obj, RSA_SIG_ALG)) {
+          overrides = {
+            category: "signature" as const,
+            hndl: false,
+            message:
+              "RSA JSON Web Key (JWK) used for signing (RS*/PS*); forgeable by a quantum attacker.",
+          };
+        } else if (rule.meta.id === "jwk-ec" && isSigningUse(obj, EC_SIG_ALG)) {
+          overrides = {
+            category: "signature" as const,
+            algorithm: "ECDSA" as const,
+            hndl: false,
+            message:
+              "Elliptic-curve JSON Web Key (JWK) used for ECDSA signing; forgeable by a quantum attacker.",
+          };
+        }
+        findings.push(findingFromRule(rule.meta, at, overrides));
+      });
+    }
+    return findings;
+  },
+};

package/src/detectors/k8s.ts

@@ -0,0 +1,115 @@
+/**
+ * Config detector: classical crypto in Kubernetes manifests — cert-manager key
+ * algorithms and service-mesh (Istio) TLS floors. These mint the certificates
+ * and secure the pod-to-pod traffic of a cluster, a surface neither the language
+ * packs nor the Terraform detector see.
+ *
+ * Covered (gated by a cert-manager / Istio marker in the document to keep the
+ * generic `algorithm:` / `minProtocolVersion:` keys from firing on unrelated YAML):
+ *  - cert-manager `Certificate`/`Issuer` `privateKey.algorithm` (or legacy
+ *    `keyAlgorithm`): `RSA` | `ECDSA` | `Ed25519`.
+ *  - Istio `minProtocolVersion: TLSV1_0 | TLSV1_1` — a legacy TLS floor on mesh
+ *    traffic, whose (EC)DHE key exchange is classical and harvestable.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from "../cwe.js";
+
+const K8S_EXTENSIONS: readonly string[] = [".yaml", ".yml", ".json"];
+
+const RE_CM_RSA = /(?:algorithm|keyAlgorithm):\s*["']?RSA\b/g;
+const RE_CM_ECDSA = /(?:algorithm|keyAlgorithm):\s*["']?ECDSA\b/g;
+const RE_CM_ED25519 = /(?:algorithm|keyAlgorithm):\s*["']?Ed25519\b/g;
+const RE_ISTIO_LEGACY_TLS = /minProtocolVersion:\s*["']?TLSV1_[01]\b/g;
+
+const RULE_CM_RSA: RuleMeta = {
+  id: "k8s-certmanager-rsa",
+  title: "cert-manager RSA key",
+  description: "cert-manager Certificate/Issuer privateKey.algorithm = RSA",
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "cert-manager mints certificates with a classical RSA key, which is not quantum-safe.",
+  remediation:
+    "Plan migration to PQC certificate keys (ML-DSA-65) as the CA/issuer chain adds support.",
+};
+const RULE_CM_ECDSA: RuleMeta = {
+  id: "k8s-certmanager-ecdsa",
+  title: "cert-manager ECDSA key",
+  description: "cert-manager Certificate/Issuer privateKey.algorithm = ECDSA",
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "cert-manager mints certificates with a classical ECDSA key, forgeable by a quantum attacker.",
+  remediation: "Plan migration to ML-DSA-65 (FIPS 204) certificate keys.",
+};
+const RULE_CM_ED25519: RuleMeta = {
+  id: "k8s-certmanager-ed25519",
+  title: "cert-manager Ed25519 key",
+  description: "cert-manager Certificate/Issuer privateKey.algorithm = Ed25519",
+  category: "certificate",
+  severity: "low",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "cert-manager mints certificates with a classical Ed25519 key, forgeable by a quantum attacker.",
+  remediation: "Plan migration to ML-DSA-65 (FIPS 204) certificate keys.",
+};
+const RULE_ISTIO_LEGACY_TLS: RuleMeta = {
+  id: "k8s-istio-legacy-tls",
+  title: "Istio legacy TLS floor",
+  description: "Istio minProtocolVersion allows TLS 1.0 / 1.1 on mesh traffic",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_RISKY_PRIMITIVE,
+  message:
+    "Istio mesh TLS floor allows TLS 1.0/1.1; its classical (EC)DHE key exchange is weak and harvestable.",
+  remediation:
+    "Raise minProtocolVersion to TLSV1_3 and track PQC-hybrid mesh KEX (X25519MLKEM768).",
+};
+
+/** Detects classical cert-manager keys and legacy Istio TLS floors in K8s YAML. */
+export const k8sDetector: Detector = {
+  id: "k8s-crypto",
+  description: "Classical crypto in Kubernetes manifests (cert-manager keys, Istio TLS floors)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_CM_RSA, RULE_CM_ECDSA, RULE_CM_ED25519, RULE_ISTIO_LEGACY_TLS],
+  appliesTo: (f) => hasExtension(f, K8S_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const isCertManager =
+      content.includes("cert-manager.io") ||
+      /kind:\s*["']?(?:Certificate|Issuer|ClusterIssuer)\b/.test(content);
+    const isIstio = content.includes("minProtocolVersion");
+    if (!isCertManager && !isIstio) return [];
+
+    // A `# algorithm: RSA` YAML comment is not an active setting; match over
+    // comment-masked content (offsets preserved).
+    const scan = maskCommentLines(content, ["#"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    if (isCertManager) {
+      add(RE_CM_RSA, RULE_CM_RSA);
+      add(RE_CM_ECDSA, RULE_CM_ECDSA);
+      add(RE_CM_ED25519, RULE_CM_ED25519);
+    }
+    if (isIstio) add(RE_ISTIO_LEGACY_TLS, RULE_ISTIO_LEGACY_TLS);
+    return findings;
+  },
+};

package/src/detectors/keystore.ts

@@ -0,0 +1,109 @@
+/**
+ * Config detector: classical cryptographic KEYSTORES committed to a repository —
+ * Java KeyStore (JKS), JCEKS, PKCS#12 (.p12/.pfx), and BouncyCastle (.bks). These
+ * binary containers hold private keys and certificate chains, essentially always
+ * classical (RSA / EC / DSA). A keystore in version control is committed key
+ * material: harvest-now-decrypt-later exposed and retroactively un-fixable.
+ *
+ * The scan pipeline reads these extensions byte-preserving (latin1; see
+ * {@link ../walk.ts isKeystorePath} and scan.ts), so `content.charCodeAt(i)` is the
+ * i-th file byte and we can identify the container by its magic number. We do NOT
+ * parse the enclosed key algorithm (that needs full ASN.1 / proprietary parsing);
+ * flagging the presence of a classical keystore is the actionable signal.
+ *
+ * The match is sensitive key material, so reporters drop the (binary) snippet.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_HARDCODED_KEY } from "../cwe.js";
+
+const KEYSTORE_EXTENSIONS: readonly string[] = [
+  ".jks",
+  ".keystore",
+  ".jceks",
+  ".bks",
+  ".p12",
+  ".pfx",
+];
+
+function baseRule(id: string, title: string, message: string): RuleMeta {
+  return {
+    id,
+    title,
+    description: message,
+    category: "certificate",
+    severity: "high",
+    confidence: "high",
+    hndl: true,
+    cwe: CWE_HARDCODED_KEY,
+    sensitive: true,
+    message,
+    remediation:
+      "Remove key material from version control and rotate it; store keys in a secret manager / HSM. Plan re-issuance with PQC keys (ML-DSA-65 / ML-KEM-768) as tooling supports it.",
+  };
+}
+
+const RULE_JKS = baseRule(
+  "keystore-jks",
+  "Java KeyStore (JKS)",
+  "A Java KeyStore (JKS) holds classical private keys / certificates (RSA/EC/DSA); a keystore in version control is committed, harvest-now-decrypt-later exposed key material.",
+);
+const RULE_JCEKS = baseRule(
+  "keystore-jceks",
+  "Java JCEKS keystore",
+  "A JCEKS keystore holds classical key material (RSA/EC/DSA); committed to version control it is harvest-now-decrypt-later exposed.",
+);
+const RULE_PKCS12 = baseRule(
+  "keystore-pkcs12",
+  "PKCS#12 keystore",
+  "A PKCS#12 container (a `.p12`/`.pfx`, or a modern `.jks`/`.keystore` — keytool writes PKCS#12 by default since Java 9) holds classical private keys / certificate chains (RSA/EC); committed to version control it is harvest-now-decrypt-later exposed.",
+);
+const RULE_BKS = baseRule(
+  "keystore-bks",
+  "BouncyCastle keystore (.bks)",
+  "A BouncyCastle (.bks) keystore holds classical key material; committed to version control it is harvest-now-decrypt-later exposed.",
+);
+
+/** Bytes-equal check against `content` read as latin1 (charCodeAt == file byte). */
+function magic(content: string, ...bytes: number[]): boolean {
+  if (content.length < bytes.length) return false;
+  for (let i = 0; i < bytes.length; i++) {
+    if (content.charCodeAt(i) !== bytes[i]) return false;
+  }
+  return true;
+}
+
+/** Detects committed classical keystores by magic number / extension. */
+export const keystoreDetector: Detector = {
+  id: "keystore-material",
+  description: "Committed classical cryptographic keystores (JKS, JCEKS, PKCS#12, BKS)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_JKS, RULE_JCEKS, RULE_PKCS12, RULE_BKS],
+  appliesTo: (f) => hasExtension(f, KEYSTORE_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const at = { file, content, index: 0, matchLength: 4 };
+    // JKS: 0xFEEDFEED. JCEKS: 0xCECECECE.
+    if (magic(content, 0xfe, 0xed, 0xfe, 0xed)) return [findingFromRule(RULE_JKS, at)];
+    if (magic(content, 0xce, 0xce, 0xce, 0xce)) return [findingFromRule(RULE_JCEKS, at)];
+    // PKCS#12 is a DER SEQUENCE. Since Java 9, `keytool` writes PKCS#12 BY DEFAULT
+    // even for files named `.jks`/`.keystore` (and Android release keystores are
+    // PKCS#12), so this runs for ANY keystore extension once the JKS/JCEKS magics
+    // fail. Accept the long-form length octets 0x81/0x82/0x83 (real PKCS#12 is
+    // always >127 bytes, so short-form would be a false positive).
+    if (content.length >= 2 && content.charCodeAt(0) === 0x30) {
+      const lenOctet = content.charCodeAt(1);
+      // Long-form DER length (0x81/0x82/0x83) or BER indefinite length (0x80, emitted
+      // by NSS/Firefox .p12 exports). Short-form is excluded (real PKCS#12 is >127 B).
+      if (lenOctet === 0x80 || lenOctet === 0x81 || lenOctet === 0x82 || lenOctet === 0x83) {
+        return [findingFromRule(RULE_PKCS12, { ...at, matchLength: 2 })];
+      }
+    }
+    // BouncyCastle keystores have no stable magic; key off the extension, but
+    // require some content so an empty `.bks` placeholder does not fire.
+    if (file.toLowerCase().endsWith(".bks") && content.length > 0) {
+      return [findingFromRule(RULE_BKS, { ...at, matchLength: 1 })];
+    }
+    return [];
+  },
+};

package/src/detectors/mesh.ts

@@ -0,0 +1,130 @@
+/**
+ * Config detector: classical crypto in SERVICE MESH configuration — the
+ * control-plane identity/CA systems and mesh-internal TLS settings of
+ * Linkerd, HashiCorp Consul Connect, and Istio. These mint the mTLS identity
+ * certificates that secure sidecar-to-sidecar traffic and are configured in
+ * their own Helm values / HCL / CRD surfaces, distinct from what `k8s.ts`
+ * already covers (cert-manager `Certificate`/`Issuer` keys and Istio's
+ * `minProtocolVersion` TLS floor — NOT duplicated here).
+ *
+ * Covered (gated by a mesh marker in the document to keep generic keys like
+ * `scheme:` / `private_key_type` from firing on unrelated YAML/HCL):
+ *  - Linkerd control-plane identity issuer: Helm values `identityTrustAnchorsPEM`
+ *    and `identity.issuer.scheme` / nested `issuer.scheme: linkerd.io/tls` — the
+ *    default self-managed Linkerd identity scheme, which mints workload
+ *    certificates from an ECDSA P-256 trust anchor. Flagged as a classical mesh
+ *    CA (certificate, ECDSA, hndl:false) since Linkerd's identity issuer signs
+ *    forgeable-by-quantum leaf certs, not a confidentiality key.
+ *  - HashiCorp Consul Connect: the `connect { ca_config { private_key_type =
+ *    "ec" | "rsa" } } }` mesh CA provider setting (also `ca_provider`). Flagged
+ *    as a classical mesh CA (certificate; ECDSA for "ec", RSA for "rsa").
+ * Istio `tls.cipherSuites:` `ECDHE-RSA-*` / `ECDHE-ECDSA-*` suites are NOT handled
+ * here — the language-agnostic `tls-classical-kex` token rule in `source.ts`
+ * already flags those cipher strings in any config file, so a rule here would
+ * double-count.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+// `.json` is included because Consul agent config is commonly JSON (the
+// `private_key_type` rules already support the JSON `:` form); the content gates
+// keep unrelated generic JSON/YAML out.
+const MESH_EXTENSIONS: readonly string[] = [".yaml", ".yml", ".hcl", ".json"];
+
+// Linkerd's default self-managed identity scheme (`linkerd.io/tls`, as opposed
+// to a `kubernetes.io/tls` bring-your-own-cert secret) mints its trust anchor
+// and issuer credentials as ECDSA P-256 by default. Matched in both nested
+// YAML form (`scheme: linkerd.io/tls`) and the flattened Helm `--set`/values
+// key form (`identity.issuer.scheme: linkerd.io/tls`), plus the distinctive
+// `identityTrustAnchorsPEM` values key which only exists in Linkerd charts.
+const RE_MESH_LINKERD_ECDSA =
+  /identityTrustAnchorsPEM\b|(?:identity\.issuer\.scheme|scheme)\s*[:=]\s*["']?linkerd\.io\/tls\b/g;
+
+// Consul Connect's CA provider config: `private_key_type = "ec" | "rsa"`
+// inside a `ca_config` block. Matched in both HCL (`=`) and JSON (`:`) forms,
+// mirroring the terraform.ts attribute-matching convention.
+const RE_MESH_CONSUL_RSA = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"rsa"/gi;
+const RE_MESH_CONSUL_EC = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"ec"/gi;
+
+const RULE_MESH_LINKERD_ECDSA: RuleMeta = {
+  id: "mesh-linkerd-identity-ecdsa",
+  title: "Linkerd ECDSA identity issuer",
+  description: "Linkerd control-plane identity issuer (default ECDSA P-256 mesh CA)",
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Linkerd's control-plane identity issuer mints workload certificates from a classical ECDSA P-256 trust anchor by default, forgeable by a quantum attacker.",
+  remediation:
+    "Plan migration to ML-DSA-65 (FIPS 204) once Linkerd's identity issuer supports PQC signing.",
+};
+const RULE_MESH_CONSUL_RSA: RuleMeta = {
+  id: "mesh-consul-connect-rsa",
+  title: "Consul Connect RSA mesh CA",
+  description: 'Consul Connect ca_config private_key_type = "rsa"',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Consul Connect's mesh CA issues leaf certificates from a classical RSA private key, which is not quantum-safe.",
+  remediation:
+    "Plan migration to PQC certificate keys (ML-DSA-65) as the Connect CA provider adds support.",
+};
+const RULE_MESH_CONSUL_EC: RuleMeta = {
+  id: "mesh-consul-connect-ec",
+  title: "Consul Connect EC mesh CA",
+  description: 'Consul Connect ca_config private_key_type = "ec"',
+  category: "certificate",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Consul Connect's mesh CA issues leaf certificates from a classical EC private key, forgeable by a quantum attacker.",
+  remediation: "Plan migration to ML-DSA-65 (FIPS 204) as the Connect CA provider adds support.",
+};
+/**
+ * Detects classical asymmetric crypto in service-mesh configuration: Linkerd's
+ * default ECDSA identity issuer and Consul Connect's mesh CA private key type.
+ * (Istio ECDHE cipher-suite strings are covered by `source.ts`'s
+ * `tls-classical-kex` token rule, so they are not duplicated here.)
+ */
+export const meshDetector: Detector = {
+  id: "service-mesh-crypto",
+  description: "Classical crypto in service-mesh config (Linkerd identity, Consul Connect CA)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_MESH_LINKERD_ECDSA, RULE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_EC],
+  appliesTo: (f) => hasExtension(f, MESH_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const isLinkerd = content.includes("linkerd") || content.includes("identityTrustAnchors");
+    const isConsulConnect = content.includes("consul") && content.includes("connect");
+    if (!isLinkerd && !isConsulConnect) return [];
+
+    // Mask whole comment lines (YAML/HCL `#`, HCL/JSON5 `//`) so a commented-out
+    // directive can't fire — `.yaml`/`.hcl`/`.json` are not centrally stripped.
+    // Offsets are preserved, so the finding location stays exact.
+    const scan = maskCommentLines(content, ["#", "//"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    if (isLinkerd) add(RE_MESH_LINKERD_ECDSA, RULE_MESH_LINKERD_ECDSA);
+    if (isConsulConnect) {
+      add(RE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_RSA);
+      add(RE_MESH_CONSUL_EC, RULE_MESH_CONSUL_EC);
+    }
+    return findings;
+  },
+};

package/src/detectors/messaging.ts

@@ -0,0 +1,106 @@
+/**
+ * Config detector: classical transport crypto in message brokers / event streams
+ * (Kafka, RabbitMQ, MQTT/Mosquitto, NATS). Broker traffic is "communication
+ * between things"; a legacy TLS floor or a classical (EC)DHE cipher suite makes
+ * every message in flight harvest-now-decrypt-later exposed.
+ *
+ * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):
+ *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).
+ *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).
+ *  - Kafka `ssl.cipher.suites` naming a static-RSA `TLS_RSA_WITH_*` key-transport
+ *    suite (the ECDHE/DHE suites are owned by source.ts's `tls-classical-kex`).
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_RISKY_PRIMITIVE, CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const MQ_EXTENSIONS: readonly string[] = [".properties", ".conf", ".cfg", ".ini"];
+
+interface MqRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const MQ_RULES: MqRule[] = [
+  {
+    // Match TLSv1 (=1.0) and TLSv1.1 but never TLSv1.2 / TLSv1.3: the negative
+    // lookahead stops "TLSv1" from matching the "TLSv1" inside "TLSv1.3".
+    re: /\bssl\.(?:enabled\.)?protocols?\s*=\s*[^\n]{0,80}?\bTLSv1(?:\.1)?(?![.\d])/gi,
+    meta: {
+      id: "mq-kafka-legacy-tls",
+      title: "Kafka legacy TLS protocol",
+      description: "Kafka ssl.protocol / ssl.enabled.protocols permits TLS 1.0 / 1.1",
+      category: "tls",
+      severity: "medium",
+      confidence: "high",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "Kafka broker permits legacy TLS 1.0/1.1, an obsolete protocol; require TLS 1.3 (the harvestable classical key exchange is reported separately by the cipher-suite rule).",
+      remediation: "Require TLS 1.3 and track PQC-hybrid KEX (X25519MLKEM768).",
+    },
+  },
+  {
+    re: /\btls_version\s+tlsv1(?:\.1)?(?![.\d])/gi,
+    meta: {
+      id: "mq-mqtt-legacy-tls",
+      title: "MQTT legacy TLS version",
+      description: "Mosquitto/MQTT tls_version permits TLS 1.0 / 1.1",
+      category: "tls",
+      severity: "medium",
+      confidence: "high",
+      hndl: false,
+      cwe: CWE_RISKY_PRIMITIVE,
+      message:
+        "MQTT broker permits legacy TLS 1.0/1.1, an obsolete protocol; require TLS 1.3 (the harvestable classical key exchange is reported separately).",
+      remediation: "Require TLS 1.3 and track PQC-hybrid KEX for device fleets.",
+    },
+  },
+  {
+    // Only static-RSA key transport (`TLS_RSA_WITH_…`) is flagged here: the ECDHE /
+    // DHE suites are owned by source.ts's language-agnostic `tls-classical-kex` token
+    // rule (which fires on `.properties` too), so flagging them here would double-count.
+    re: /\bssl\.cipher\.suites\s*=\s*[^\n]{0,200}?\bTLS_RSA_WITH_/g,
+    meta: {
+      id: "mq-rsa-key-transport",
+      title: "Broker static-RSA key transport cipher",
+      description:
+        "Kafka ssl.cipher.suites names a static-RSA (TLS_RSA_WITH_*) key-transport suite",
+      category: "kem",
+      algorithm: "RSA",
+      severity: "medium",
+      confidence: "high",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Broker TLS is pinned to a static-RSA (TLS_RSA_WITH_*) key-transport suite; the wrapped session key is harvest-now-decrypt-later exposed (and it has no forward secrecy).",
+      remediation:
+        "Move to TLS 1.3 with a PQC-hybrid group (X25519MLKEM768) once the broker/runtime supports it.",
+    },
+  },
+];
+
+/** Detects classical transport crypto in message-broker / event-stream config. */
+export const messagingDetector: Detector = {
+  id: "messaging-transport",
+  description: "Classical transport crypto in message brokers (Kafka, MQTT, RabbitMQ, NATS)",
+  scope: "config",
+  language: "any",
+  rules: MQ_RULES.map((r) => r.meta),
+  appliesTo: (f) => hasExtension(f, MQ_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    const findings: Finding[] = [];
+    // Broker config files ship large commented-out example blocks; a commented
+    // directive is not active. Match over comment-masked content (offsets preserved,
+    // so the snippet from the original `content` is still correct).
+    const scan = maskCommentLines(content, ["#", "!", ";"]);
+    for (const rule of MQ_RULES) {
+      eachMatch(rule.re, scan, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};